Prisma Cloud Correlate Alerts Deprecated Hidden

Deprecated. Use Prisma Cloud Correlate Alerts v2 instead. Search alerts in Prisma Cloud for a specific asset ID and, if present in XSOAR, link them.

Prisma Cloud by Palo Alto Networks · 12 tasks · 2 inputs · 2 outputs

Details

IDPrisma Cloud Correlate Alerts
From Version6.0.0
Tasks12

README

Search alerts in Prisma Cloud for a specific asset ID and, if present in XSOAR, link them.
Supported Cortex XSOAR versions: 6.0.0 and later.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • PrismaCloud v2

Scripts

  • SearchIncidentsV2
  • ToTable

Commands

  • linkIncidents
  • redlock-search-alerts

Playbook Inputs

Name Description Default Value Required
Prisma Cloud Attribution Attribution information from Prisma Cloud. PrismaCloud.Attribution Optional
Link Incidents Link found Prisma Cloud incidents to current one? True Optional

Playbook Outputs

Path Description Type
foundIncidents Found Prisma Cloud Incidents unknown
PrismaCloud.Alert Prisma Cloud Alert unknown

Playbook Image

Prisma Cloud Correlate Alerts

Inputs

  • Prisma Cloud Attribution — Attribution information from Prisma Cloud.
  • Link Incidents — Link found Prisma Cloud incidents to current one?

Outputs

  • foundIncidents — Found Prisma Cloud Incidents
  • PrismaCloud.Alert — Prisma Cloud Alert

Commands used

linkIncidents redlock-search-alerts

Flowchart

yes yes yes yes yes Start Start Prisma Cloud Alert Detection Prisma Cloud Alert Detection Are assets in Prisma Cloud found? Are assets in Prisma Clou... Done Prisma Cloud Alert Detection Done Prisma Cloud Alert D... Find Prisma Cloud Alerts for detected assets - redlock-search-alerts Find Prisma Cloud Alerts ... redlock-search-alerts Print Prisma Cloud Alerts - ToTable Print Prisma Cloud Alerts ToTable Find Prisma Cloud Incidents - SearchIncidentsV2 Find Prisma Cloud Incidents SearchIncidentsV2 Link Incidents - linkIncidents Link Incidents linkIncidents Prisma Cloud Alerts found? Prisma Cloud Alerts found? Are we linking found Prisma Cloud Incidents? Are we linking found Pris... Is Prisma Cloud enabled? Is Prisma Cloud enabled? Did we find any related Prisma Cloud incidents to link? Did we find any related P...

Source

playbook-Prisma_Cloud_Correlate_Alerts.yml playbook-Prisma_Cloud_Correlate_Alerts_v2.yml playbook-Prisma_Cloud_Correlate_Alerts_v2_README.md
Download History Raw 
Search alerts in Prisma Cloud for a specific asset ID and, if present in XSOAR, link them.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

PrismaCloud v2

### Scripts

* SearchIncidentsV2
* ToTable

### Commands

* linkIncidents
* prisma-cloud-alert-search

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| Prisma Cloud Attribution | Attribution information from Prisma Cloud. | PrismaCloud.Attribution | Optional |
| Link Incidents | Link found Prisma Cloud incidents to current one? | True | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| foundIncidents | Found Prisma Cloud incidents | unknown |
| PrismaCloud.Alert | Prisma Cloud alert. | unknown |

## Playbook Image

---

![Prisma Cloud Correlate Alerts v2](../doc_files/Prisma_Cloud_Correlate_Alerts_v2.png)